Requiring a compliant device gives you the most control over device management, minimizing risk.

For devices already managed by Microsoft Intune, now a part of Microsoft Endpoint Manager, you can limit access through Conditional Access policies.

You can restrict file access to managed devices and applications, or you can limit file downloads and file access from unmanaged devices while still allowing app access. You have a couple of options for ensuring that users only keep files on devices you trust, depending on your endpoint management strategy and which features you’re already using. What can I do to keep control of company data? Question: I’m seeing more devices connect from personal and work devices outside my trusted networks.

When you’re done making changes, run the new MFA Authentication method analyzer to make sure you didn’t miss any recommended steps.

This will help when someone gets a new phone with a new number. Be sure to have them register a backup method, such as a phone number for SMS and voice call MFA, or a hardware token. Otherwise they’ll be prompted when they first sign-into an application that requires MFA. For example, they’ll get fewer MFA prompts for applications on mobile devices.

Defaulting to the Microsoft Authenticator app as their primary MFA method will give users the best experience, especially if they’re based outside the US.

If you can’t require a corporate device, block MFA registration outside a certain time window so that users who miss the deadline have to contact the helpdesk.

For example, you can require registration from Microsoft Intune compliant or hybrid Azure AD joined devices.

Place limits to help thwart attackers trying to register as users.If you haven’t already done so, enable combined security information registration, which will give your end users the best experience and register them for Self Service Password Reset (SSPR).We recommend using a Conditional Access policy to enable MFA for all users.

Question: What’s the best way for users working from home to set up MFA? To help, we’d like to share best practices and tips, aligned with the principles of Zero Trust, that we’ve assembled from working closely with customers in these trying times. For them, quickly enabling remote work while keeping company data safe presents new challenges and amplifies old ones.

Organizations asking employees to work from home to slow the spread of COVID-19 are making huge organizational and process changes in a matter of weeks, not years. Industry trends and changes in the way we work usually span years, with organizations evolving at their own pace.

Conditional access mfa